Data processing agreement (dpa) — Google Analytics 4

Cited by

Facts read from this source

• Google is processor Report an error

  “Google is a processor of Customer Personal Data;”

• Customer role Report an error

  “Customer is a controller or processor, as applicable, of Customer Personal Data”

• Legislation scope Report an error

  “any national, federal, EU, state, provincial or other privacy, data security or data protection law or regulation including European Data Protection Legislation, the LGPD and US State Privacy Laws”

• Deletion max days Report an error

  “then Google will delete such Customer Personal Data from its systems as soon as reasonably practicable and within a maximum period of 180 days, unless applicable laws require storage.”

• Deletion on expiry Report an error

  “Customer instructs Google to delete all remaining Customer Personal Data (including existing copies) from Google’s systems at the end of the Term in accordance with applicable law. Google will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless applicable laws require storage.”

• Deletion fee possible Report an error

  “Google may charge a fee (based on Google’s reasonable costs) for any data deletion under Section 6.1.2(a).”

• Retention practices URL Report an error

  “(b) the data retention practices described at policies.google.com/technologies/ads.”

• Encryption at rest Report an error

  “Google’s security policies mandate encryption at rest for all user data, including personal data.”

• Aes256 storage encryption Report an error

  “All personal data is encrypted at the storage level, generally using AES256.”

• Fips 140 2 Report an error

  “Google uses common cryptographic libraries which incorporate Google’s FIPS 140-2 validated module, to implement encryption consistently across the Processor Services.”

• Tls pfs Report an error

  “Google makes HTTPS encryption (also referred to as TLS connection) available. Google servers support ephemeral elliptic curve Diffie Hellman cryptographic key exchange signed with RSA and ECDSA. These perfect forward secrecy (PFS) methods help protect traffic”

• ISO 27001 Report an error

  “To evaluate and help ensure the continued effectiveness of the Security Measures, Google will maintain the ISO 27001 Certification.”

• Third party audit Report an error

  “Customer may also verify Google’s compliance with its obligations under these Data Processing Terms by reviewing the certificate issued for the ISO 27001 Certification (which reflects the outcome of an audit conducted by a third party auditor).”

• Incident notification Report an error

  “If Google becomes aware of a Data Incident, Google will: (a) notify Customer of the Data Incident promptly and without undue delay; and (b) promptly take reasonable steps to minimise harm and secure Customer Personal Data.”

• Notification delivery Report an error

  “Google will deliver its notification of any Data Incident to the Notification Email Address or, at Google’s discretion (including if Customer has not provided a Notification Email Address), by other direct communication (for example, by phone call or an in-person meeting).”

• Dpi assistance Report an error

  “Google will (taking into account the nature of the processing and the information available to Google) assist Customer in ensuring compliance with Customer’s (or, where Customer is a processor, the relevant controller’s) obligations relating to data protection impact assessments and prior regulatory consultations under Applicable Data Protection Legislation”

• Data subject tools Report an error

  “a tool (if any) made available by a Google Entity to data subjects that enables Google to respond directly and in a standardised manner to certain requests from data subjects in relation to Customer Personal Data (for example, online advertising settings or an opt-out browser plugin)”

• Data subject request routing Report an error

  “(a) respond directly to the data subject’s request in accordance with the standard functionality of the Data Subject Tool (if the request is made via a Data Subject Tool); or (b) advise the data subject to submit their request to Customer”

• Any country processing Report an error

  “Subject to any provisions applicable to data transfers set out in the Additional Terms, Google may process Customer Personal Data in any country in which Google or its Subprocessors maintain facilities.”

• Datacentre locations URL Report an error

  “Information about the locations of Google data centres is available at www.google.com/about/datacenters/locations/.”

• List URL Report an error

  “Information about Subprocessors is available at business.safety.google/adssubprocessors.”

• New subprocessor notice days Report an error

  “When any New Subprocessor is engaged during the Term, Google will, at least 30 days before the New Subprocessor processes any Customer Personal Data, inform Customer of the engagement”

• Objection termination days Report an error

  “Customer may object to any New Subprocessor by terminating the Agreement for convenience immediately upon written notice to Google, on condition that Customer provides such notice within 90 days of being informed of the engagement of the New Subprocessor”

• Google liability Report an error

  “remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor.”

• Security audit Report an error

  “Before onboarding Subprocessors, Google conducts an audit of the security and privacy practices of Subprocessors”

• Duration Report an error

  “Regardless of whether the Agreement has terminated or expired, these Data Processing Terms will remain in effect until, and automatically expire when, Google deletes all Customer Personal Data as described in these Data Processing Terms.”

• Liability US Report an error

  “a state of the United States of America, then, regardless of anything else in the Agreement, the total liability of either party towards the other party under or in connection with these Data Processing Terms will be limited to the maximum monetary or payment-based amount at which that party’s liability is capped under the Agreement”

• Order of precedence Report an error

  “(a) the Additional Terms (if applicable); (b) the remainder of these Data Processing Terms; and (c) the remainder of the Agreement.”

• Term change notice days Report an error

  “Google will inform Customer at least 30 days (or such shorter period as may be required to comply with applicable law, applicable regulation, a court order or guidance issued by a governmental regulator or agency) before the change will take effect”

• Term change objection days Report an error

  “If Customer objects to any such change, Customer may immediately terminate the Agreement for convenience by giving written notice to Google within 90 days of being informed by Google of the change.”

• Additional products excluded Report an error

  “these Data Processing Terms do not apply to the processing of personal data in connection with the provision of any Additional Product used by Customer, including personal data transmitted to or from that Additional Product.”

• Confidentiality commitments Report an error

  “ensure that all persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.”

• Background checks Report an error

  “Google conducts reasonably appropriate background checks to the extent legally permissible and in accordance with applicable local labor law and statutory regulations.”

• Pseudonymous data controls Report an error

  “Google has a robust set of policies and technical and organisational controls in place to ensure the separation between pseudonymous data and personally identifiable user information”

• Privacy launch reviews Report an error

  “Google conducts launch reviews for new products and features prior to launch. This includes a privacy review conducted by specially trained privacy engineers.”

• Disk destruction Report an error

  “Decommissioned Disks are erased in a multi-step process and verified complete by at least two independent validators.”

• Cctv retention Report an error

  “Cameras record on-site via digital video recorders 24 hours a day, 7 days a week. The surveillance records are retained for at least 7 days based on activity.”

• Processing records Report an error

  “Google will keep appropriate documentation of its processing activities as required by Applicable Data Protection Legislation.”

• English version governs Report an error

  “To the extent any translated version of these Data Processing Terms is inconsistent with the English version, the English version will govern.”

• Subprocessor contract required Report an error

  “ensure via a written contract that the Subprocessor only accesses and uses Customer Personal Data to the extent required to perform the obligations subcontracted to it”

• Data isolation Report an error

  “Google logically isolates each customer's data.”

• Multi tenant servers Report an error

  “Google stores data in a multi-tenant environment on Google-owned servers.”

• Authentication Report an error

  “Google requires the use of unique user IDs, strong passwords, two factor authentication and carefully monitored access lists to minimise the potential for unauthorised account use.”

• Backup power Report an error

  “If utility power is interrupted, backup power is designed to provide transitory power to the data centre, at full capacity, for up to 10 minutes until the backup generator systems take over.”

• Replication Report an error

  “Data, the Processor Services database and file system architecture are replicated between multiple geographically dispersed data centres.”

• Access logging Report an error

  “Access to systems is logged to create an audit trail for accountability.”

6 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agency Developer Data access, export & self-hosting
• The Agency Developer European sovereignty
• The Data Protection Officer Consent-free operation & data minimisation
• The Data Protection Officer Data access, export & self-hosting
• The Data Protection Officer European sovereignty
• The E-Commerce Marketing Lead Data access, export & self-hosting
• The E-Commerce Marketing Lead European sovereignty
• The Growth Analyst Consent-free operation & data minimisation
• The Growth Analyst Data access, export & self-hosting
• The Growth Analyst European sovereignty
• The Public-Sector Site Owner Consent-free operation & data minimisation
• The Public-Sector Site Owner Data access, export & self-hosting
• The Public-Sector Site Owner European sovereignty
• The Skeptic Data access, export & self-hosting
• The Skeptic European sovereignty